ClipBucket v5 has an improper neutralization of SQL wildcard characters in its subtitle editing endpoint, allowing an authenticated user to send a percentage sign as the number parameter and overwrite all subtitle titles for videos they own in a single request. This results in mass alteration of subtitle data, compromising content integrity but not granting arbitrary code execution or exposing sensitive data. The flaw corresponds to CWE-155 and CWE-943.

All installations of the MacWarrior ClipBucket platform version 5.5.2 and earlier are affected. The defect was fixed in release 5.5.3 (commit #141). Users running any earlier release should verify their version and upgrade accordingly.

The CVSS score of 4.3 indicates moderate severity. The vulnerability requires authentication and ownership of a video, so the threat is limited to the user’s own content. Because an attacker must first obtain legitimate credentials, exploitation probability is relatively low, and the flaw is not listed in the CISA KEV catalog. Nonetheless, the ability to overwrite all subtitle titles can cause significant disruption to a user’s video data.